From 466495f57df083c15c1c2cfb65dde31fde675691 Mon Sep 17 00:00:00 2001
From: "peterv%propagandism.org" <peterv%propagandism.org>
Date: Tue, 4 Dec 2007 18:53:53 +0000
Subject: [PATCH] Fix for bug 398466 (XBL unlinking triggered hash-table
 recursion assertion (again)). r/sr=sicking.

---
 content/xbl/src/nsBindingManager.cpp | 22 ++++++++++++++++++++++
 content/xbl/src/nsBindingManager.h   |  1 +
 2 files changed, 23 insertions(+)

diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index 48e4db4d477..a23a4c86996 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -328,6 +328,8 @@ SetOrRemoveObject(PLDHashTable& table, nsIContent* aKey, nsISupports* aValue)
 // Implement our nsISupports methods
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBindingManager)
+  tmp->mDestroyed = PR_TRUE;
+
   if (tmp->mBindingTable.IsInitialized())
     tmp->mBindingTable.Clear();
 
@@ -404,6 +406,7 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsBindingManager)
 // Constructors/Destructors
 nsBindingManager::nsBindingManager(nsIDocument* aDocument)
   : mProcessingAttachedStack(PR_FALSE),
+    mDestroyed(PR_FALSE),
     mAttachedStackSizeOnOutermost(0),
     mDocument(aDocument)
 {
@@ -415,6 +418,8 @@ nsBindingManager::nsBindingManager(nsIDocument* aDocument)
 
 nsBindingManager::~nsBindingManager(void)
 {
+  mDestroyed = PR_TRUE;
+
   if (mContentListTable.ops)
     PL_DHashTableFinish(&mContentListTable);
   if (mAnonymousNodesTable.ops)
@@ -553,6 +558,11 @@ nsBindingManager::SetInsertionParent(nsIContent* aContent, nsIContent* aParent)
 {
   NS_ASSERTION(!aParent || aParent->HasFlag(NODE_IS_INSERTION_PARENT),
                "Insertion parent should have NODE_IS_INSERTION_PARENT flag!");
+
+  if (mDestroyed) {
+    return NS_OK;
+  }
+
   return SetOrRemoveObject(mInsertionParentTable, aContent, aParent);
 }
 
@@ -569,6 +579,10 @@ nsBindingManager::GetWrappedJS(nsIContent* aContent)
 nsresult
 nsBindingManager::SetWrappedJS(nsIContent* aContent, nsIXPConnectWrappedJS* aWrappedJS)
 {
+  if (mDestroyed) {
+    return NS_OK;
+  }
+
   return SetOrRemoveObject(mWrapperTable, aContent, aWrappedJS);
 }
 
@@ -656,6 +670,10 @@ nsresult
 nsBindingManager::SetContentListFor(nsIContent* aContent,
                                     nsInsertionPointList* aList)
 {
+  if (mDestroyed) {
+    return NS_OK;
+  }
+
   nsIDOMNodeList* contentList = nsnull;
   if (aList) {
     contentList = new nsAnonymousContentList(aList);
@@ -712,6 +730,10 @@ nsresult
 nsBindingManager::SetAnonymousNodesFor(nsIContent* aContent,
                                        nsInsertionPointList* aList)
 {
+  if (mDestroyed) {
+    return NS_OK;
+  }
+
   nsIDOMNodeList* contentList = nsnull;
   if (aList) {
     contentList = new nsAnonymousContentList(aList);
diff --git a/content/xbl/src/nsBindingManager.h b/content/xbl/src/nsBindingManager.h
index 67516ae5fd8..689ba3de10f 100755
--- a/content/xbl/src/nsBindingManager.h
+++ b/content/xbl/src/nsBindingManager.h
@@ -280,6 +280,7 @@ protected:
   // A queue of binding attached event handlers that are awaiting execution.
   nsBindingList mAttachedStack;
   PRPackedBool mProcessingAttachedStack;
+  PRPackedBool mDestroyed;
   PRUint32 mAttachedStackSizeOnOutermost;
 
   // Our posted event to process the attached queue, if any